igrantio-api-team-management

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires sending a bearer access token in the Authorization header ("Authorization: Bearer "), which encourages the LLM to insert a secret value verbatim into requests or example commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to fetch the linked documentation or the raw OpenAPI spec (e.g. https://docs.igrant.io/openapispecifications/oid4vc.yaml and the per-operation docs like https://docs.igrant.io/docs/openid4vc-api/config-create-organisation-admin/), which would supply authoritative instructions/specification that directly control the agent's behavior.